During the rework, we focused on a few things primarily:
1. Reduce password complexity, enforce legnth 2. Restructure account creation around least-privilege principal, so that access had to be granted, not just created during account creation, and also allow fast and easy addition and removal of access to system as part of the Management System 3. Revisit password expiries based on level of access and relative strength of password (as determined by zxcvbn)
Students and low level staff loved it - if you had a standard account and didn't have any access to anything sensitive that didn't belong to you, your password could sit untouched for up to 2 years I think if it met the strength requirements.
Those with access to actual sensitive data (student records, finances, etc), were held to a higher class of password complexity and would suffer a rotation penalty if they didn't have a sufficiently complex password; this mostly did away with the number of people with very common passwords, though it didn't go without a lot of fighting for some of the administrators, which, as I remember the discussions anyways, were more pride issues than anything. We used that as an opportunity to roll out password managers
1. The cover time (expected duration of secrecy) is about to expire, either due to advances in technology or because it was too small to begin with; or
2. The password was compromised and is no longer secret.
If a password has not been compromised and is sufficiently strong as to not be crackable without a server farm and hundreds of thousands of years, it doesn't make sense to change it.
Anecdotally, I've had good success forcing longer passwords while at the same time, introducing people to password managers. Doing only one or the other does not have the same uptake but we recently went through and forced everyone to reset their passwords. We're now up to 16 chars, I'd like to get to 30 (or to a point where it's a pain to type it in) but baby steps, I suppose.